rea-agents 6.5.0 → 6.7.0

package/dist/cli-runtime/{workflowInputError-n8Oo-bLA.js → workflowInputError-BP8z9Wxl.js}

@@ -1,6 +1,6 @@
 import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
-import { analysisInputErrorFromIssues, init_inputIssueProjection } from "./reconstructionObligationLedgerSchemas-Bao0xMr-.js";
-import { AnalysisInputError, init_analysisErrorCore } from "./errorSchemas-CTRmvMl3.js";
+import { analysisInputErrorFromIssues, init_inputIssueProjection } from "./reconstructionObligationLedgerSchemas-Bi6sect1.js";
+import { AnalysisInputError, init_analysisErrorCore } from "./errorSchemas-Ixz_q7qt.js";
 import { z } from "zod";
 
 //#region dist/application/workflowInputError.js

package/dist/cli.js

@@ -11,6 +11,7 @@ import { registerAnalysisViewCommands } from "./cli/analysisViewCommands.js";
 import { registerBinaryDiagnosticsCommands } from "./cli/binaryDiagnosticsCommands.js";
 import { registerFridaCommands } from "./cli/fridaCommands.js";
 import { Cli } from "incur";
+import { normalizeCliArguments } from "./cliOutput.js";
 import { createLogger, parseLogLevel } from "./logger.js";
 import { projectAnalysisError } from "./domain/analysisErrorProjection.js";
 import { PRODUCT_IDENTITY } from "./identity.js";
@@ -74,6 +75,13 @@ export const createCli = (selectedEnvironment = process.env, resultOutput, frida
             instructions: "Ask what software, artifact, protocol, or behavior the user wants to understand, then choose the available investigation capabilities that can produce evidence.",
         },
         sync: false,
+        update: {
+            // Incur's update:false only suppresses notices. Reject its explicit
+            // installer so ambiguous flags cannot bypass REA's verified workflow.
+            install: () => {
+                throw new Error("Use 'rea update' to update the identified installation. The '--update' alias accepts only global output flags.");
+            },
+        },
     });
     registerSetupCommands(cli, logger, environment);
     registerReverseEngineeringCommands(cli, logger, environment);
@@ -116,5 +124,7 @@ export const createCli = (selectedEnvironment = process.env, resultOutput, frida
     presentOmittableDefaults(cli);
     if (resultOutput !== undefined)
         streamCliCommandResults(cli, resultOutput);
+    const serve = cli.serve.bind(cli);
+    cli.serve = (arguments_ = process.argv.slice(2), options) => serve(normalizeCliArguments(arguments_), options);
     return cli;
 };

package/dist/cliBrowserScenarioCommands.js

@@ -5,11 +5,10 @@ import { withCommandCancellation } from "./cli/commandCancellation.js";
 import { CLI_COMMANDS } from "./cliCommandNames.js";
 import { parseCliJsonInput, resolveCliJsonPaths } from "./cliJsonInput.js";
 import { logCliCommand } from "./cliLogging.js";
-import { AnalysisInputError } from "./domain/analysisErrorCore.js";
 import { AnalysisError } from "./domain/analysisErrorBase.js";
 import { projectAnalysisError } from "./domain/analysisErrorProjection.js";
 import { BrowserObservationError } from "./domain/browserObservationError.js";
-import { projectInputIssues } from "./domain/inputIssueProjection.js";
+import { analysisInputErrorFromIssues } from "./domain/inputIssueProjection.js";
 import { browserScenarioSchema } from "./domain/browserScenario.js";
 const OPERATION = "capture_browser_scenario";
 /** Register the one-shot controlled browser scenario command. */
@@ -27,7 +26,7 @@ export const registerBrowserScenarioCommands = (cli, logger, environment) => {
                 return input.error;
             const scenario = browserScenarioSchema.safeParse(resolveCliJsonPaths(input.value, [["browser", "executable_path"]]));
             if (!scenario.success)
-                return cliError(new AnalysisInputError(OPERATION, { cause: scenario.error }, projectInputIssues(scenario.error.issues, input.value)));
+                return cliError(analysisInputErrorFromIssues(OPERATION, scenario.error.issues, input.value, { cause: scenario.error }));
             // Load Playwright only for this command, not during CLI startup.
             const { createBrowserScenarioProvider } = await import("./composition/browserScenario.js");
             const provider = createBrowserScenarioProvider(environment);

package/dist/cliLogging.js

@@ -3,6 +3,14 @@ import { AnalysisError } from "./domain/analysisErrorBase.js";
 import { projectAnalysisError, } from "./domain/analysisErrorProjection.js";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const loggedFailures = new WeakMap();
+const canonicalFailure = (projection) => ({
+    payload: projection,
+    identity: {
+        code: projection.code,
+        category: projection.category,
+        retryable: projection.retryable,
+    },
+});
 /** Return the canonical failure projection owned by the CLI result boundary. */
 const projectCliOperationFailure = (value) => {
     if (!isRecord(value))
@@ -34,22 +42,27 @@ const projectCliOperationFailure = (value) => {
     }
     return undefined;
 };
-/** Return the canonical projection or original record classified as failed. */
+/** Keep the classified payload and its canonical identity under one owner. */
 const inferCliOperationFailure = (value) => {
     const projection = projectCliOperationFailure(value);
     if (projection !== undefined)
-        return projection;
+        return canonicalFailure(projection);
     if (isRecord(value) && value.healthy === false)
-        return value;
+        return { payload: value };
     return undefined;
 };
 export const cliOperationFailurePayload = (value) => {
     if (isRecord(value) && loggedFailures.has(value))
-        return loggedFailures.get(value);
-    return inferCliOperationFailure(value);
+        return loggedFailures.get(value)?.payload;
+    const failure = inferCliOperationFailure(value);
+    if (failure !== undefined && isRecord(value))
+        loggedFailures.set(value, failure);
+    return failure?.payload;
 };
 /** Identify caller-visible CLI outcomes that mean the requested operation failed. */
 export const isCliOperationFailure = (value) => cliOperationFailurePayload(value) !== undefined;
+/** Already classified identity, without traversing payloads during recovery. */
+export const cliOperationFailureIdentity = (value) => isRecord(value) ? loggedFailures.get(value)?.identity : undefined;
 /** Log one CLI command with duration and a stable success or failure status. */
 export const logCliCommand = async (logger, command, execute, isCommandFailure) => {
     const startedAt = performance.now();
@@ -58,7 +71,7 @@ export const logCliCommand = async (logger, command, execute, isCommandFailure)
         const inferredFailure = inferCliOperationFailure(value);
         const failed = isCommandFailure?.(value) ?? inferredFailure !== undefined;
         if (isRecord(value))
-            loggedFailures.set(value, failed ? (inferredFailure ?? value) : undefined);
+            loggedFailures.set(value, failed ? (inferredFailure ?? { payload: value }) : undefined);
         logger[failed ? "error" : "info"]({
             command,
             durationMs: Math.round((performance.now() - startedAt) * 100) / 100,
@@ -77,7 +90,9 @@ export const logCliCommand = async (logger, command, execute, isCommandFailure)
         }, "CLI command failed");
         if (cause instanceof AnalysisError) {
             process.exitCode = 1;
-            return projectAnalysisError(cause);
+            const projection = projectAnalysisError(cause);
+            loggedFailures.set(projection, canonicalFailure(projection));
+            return projection;
         }
         throw cause;
     }

package/dist/cliObservationOptions.js

@@ -57,6 +57,9 @@ export const electronPageInspectionOptions = z.object({
 export const javascriptApplicationOptions = z.object({
     maxSemanticNodes: javaScriptAnalysisResourceControlsSchema.shape.max_semantic_nodes,
     maxSemanticNodesPerFile: javaScriptAnalysisResourceControlsSchema.shape.max_semantic_nodes_per_file,
+    maxSemanticUnknowns: javaScriptAnalysisResourceControlsSchema.shape.max_semantic_unknowns,
+    maxSemanticUnknownsPerFile: javaScriptAnalysisResourceControlsSchema.shape
+        .max_semantic_unknowns_per_file,
     sourcePath: javaScriptSourcePathsSchema
         .optional()
         .describe("Exact inventoried file path relative to the application root; repeat to select several. No implicit dependencies."),

package/dist/cliOutput.js

@@ -1,10 +1,59 @@
 const UNSUPPORTED_OUTPUT_COMBINATION_MESSAGE = "Token windows cannot preserve structured output. Remove --token-limit/--token-offset and use --filter-output or command pagination.";
 const INCUR_OUTPUT_FORMATS = new Set(["toon", "json", "yaml", "md", "jsonl"]);
+/** Global output flags that take a value. */
+const VALUED_OUTPUT_FLAGS = new Set([
+    "--format",
+    "--filter-output",
+    "--token-limit",
+    "--token-offset",
+]);
+const ROOT_UPDATE_OUTPUT_FLAGS = new Set([
+    "--json",
+    "--full-output",
+    "--token-count",
+]);
+/**
+ * Route the root update alias and split `--flag=value` output forms. Incur reads these
+ * flags only in spaced form, so `--format=json` otherwise reaches the command
+ * parser and fails as an unknown flag. Command options accept both forms.
+ */
+export const normalizeCliArguments = (arguments_) => {
+    const normalized = [];
+    const updates = new Set();
+    let rootUpdate = true;
+    for (let index = 0; index < arguments_.length; index += 1) {
+        const argument = arguments_[index];
+        if (VALUED_OUTPUT_FLAGS.has(argument) && arguments_[index + 1]) {
+            // Incur consumes a nonempty spaced value before looking for more flags.
+            // Its contents belong to that option, even when they look like a flag.
+            normalized.push(argument, arguments_[index + 1]);
+            index += 1;
+            continue;
+        }
+        const separator = argument.indexOf("=");
+        const flag = argument.slice(0, separator);
+        if (separator >= 0 && VALUED_OUTPUT_FLAGS.has(flag))
+            normalized.push(flag, argument.slice(separator + 1));
+        else {
+            if (argument === "--update")
+                updates.add(normalized.length);
+            else if (!ROOT_UPDATE_OUTPUT_FLAGS.has(argument))
+                rootUpdate = false;
+            normalized.push(argument);
+        }
+    }
+    // Output option values were consumed above; flag-shaped data is never an alias.
+    // Help/check/command/unknown tokens retain Incur's parsing and precedence.
+    return rootUpdate && updates.size > 0
+        ? ["update", ...normalized.filter((_, index) => !updates.has(index))]
+        : normalized;
+};
 /** Read effective Incur output controls at the executable boundary. */
 export const parseCliOutputArguments = (arguments_) => {
     let format = "toon";
     let filterOutput;
     let fullOutput = false;
+    let missingValue;
     let tokenCount = false;
     let tokenLimit;
     let tokenOffset;
@@ -12,6 +61,7 @@ export const parseCliOutputArguments = (arguments_) => {
         filterOutput,
         format,
         fullOutput,
+        missingValue,
         parseError,
         tokenCount,
         tokenWindow: !parseError && (tokenLimit !== undefined || tokenOffset !== undefined),
@@ -20,8 +70,8 @@ export const parseCliOutputArguments = (arguments_) => {
     });
     for (let index = 0; index < arguments_.length; index += 1) {
         const argument = arguments_[index];
-        // Incur scans builtins across `--` and accepts only spaced value forms.
-        // Mirror those effective values at the executable output boundary.
+        // Incur scans builtins across `--` and reads spaced value forms, which
+        // normalizeCliArguments has produced. Mirror those effective values.
         if (argument === "--json") {
             format = "json";
             continue;
@@ -36,6 +86,8 @@ export const parseCliOutputArguments = (arguments_) => {
                 format = value;
                 index += 1;
             }
+            else
+                missingValue ??= argument;
             continue;
         }
         if (argument === "--filter-output") {
@@ -43,6 +95,8 @@ export const parseCliOutputArguments = (arguments_) => {
                 filterOutput = arguments_[index + 1];
                 index += 1;
             }
+            else
+                missingValue ??= argument;
             continue;
         }
         if (argument === "--token-limit" || argument === "--token-offset") {
@@ -57,6 +111,8 @@ export const parseCliOutputArguments = (arguments_) => {
                     tokenOffset = numericValue;
                 index += 1;
             }
+            else
+                missingValue ??= argument;
             continue;
         }
         if (argument === "--full-output")
@@ -88,7 +144,7 @@ const hasUnclosedFilterSlice = (expression) => {
 };
 /** Reject output controls that cannot safely produce a complete result. */
 export const validateCliOutputArguments = (arguments_) => {
-    const { filterOutput, format, parseError, tokenWindow } = parseCliOutputArguments(arguments_);
+    const { filterOutput, format, missingValue, parseError, tokenWindow } = parseCliOutputArguments(arguments_);
     if (parseError)
         return { ok: true };
     if (filterOutput !== undefined && hasUnclosedFilterSlice(filterOutput))
@@ -106,6 +162,15 @@ export const validateCliOutputArguments = (arguments_) => {
             code: "UNSUPPORTED_OUTPUT_COMBINATION",
             message: UNSUPPORTED_OUTPUT_COMBINATION_MESSAGE,
         };
+    // Incur skips a valued flag without a value and then reports the flag
+    // itself as unknown. Name the missing value instead.
+    if (missingValue !== undefined)
+        return {
+            ok: false,
+            format: format === "yaml" || format === "jsonl" ? format : "json",
+            code: "MISSING_OUTPUT_VALUE",
+            message: `${missingValue} requires a value, as in ${missingValue} <value> or ${missingValue}=<value>.`,
+        };
     return { ok: true };
 };
 /** Preserve a complete document when Incur filters the entire result away. */

package/dist/composition/binary.js

@@ -1,7 +1,9 @@
+import { isAppleDispatchMetadataTarget } from "../domain/native/objcSwiftMetadata.js";
 import { snapshotEnvironment } from "../process/snapshotEnvironment.js";
 import { HopperProvider } from "../hopper/HopperProvider.js";
 import { GhidraProvider } from "../ghidra/GhidraProvider.js";
 import { IdaProvider } from "../ida/IdaProvider.js";
+import { KunaProvider } from "../kuna/KunaProvider.js";
 import { auxiliaryAnalysisProviderDeclarations } from "./auxiliaryAnalysisProviders.js";
 import { AnalysisProviderRegistry } from "../application/binary/AnalysisProviderRegistry.js";
 import { composeBinarySession } from "../application/binary/BinarySessionComposition.js";
@@ -12,12 +14,19 @@ import { ManagedStaticProvider } from "../dotnet/ManagedStaticProvider.js";
  * This is the sole production wiring point, so both adapters share identical
  * provider selection, profile, lifecycle, and Evidence semantics.
  */
-export const createBinarySession = (config, logger, selectedEnvironment) => {
+export const createBinarySession = (config, logger, selectedEnvironment) => composeDeepBinarySession(config, logger, selectedEnvironment);
+/** Prefer byte-backed dispatch inspection while retaining deep symbol fallback. */
+export const createNativeDispatchBinarySession = (config, logger, selectedEnvironment) => composeDeepBinarySession(config, logger, selectedEnvironment, "inspect_native_dispatch_metadata");
+const composeDeepBinarySession = (config, logger, selectedEnvironment, inspection) => {
     const environment = snapshotEnvironment(selectedEnvironment);
     const hopper = new HopperProvider(config, logger, environment);
     const ghidra = new GhidraProvider(config, logger, environment);
     const ida = new IdaProvider(config, environment);
-    return composeBinarySession(new AnalysisProviderRegistry([hopper, ghidra, ida], config.analysisProvider), auxiliaryAnalysisProviderDeclarations(environment).map((declaration) => new LazyAnalysisProvider(declaration)));
+    const kuna = new KunaProvider(environment);
+    const auxiliaryDeclarations = auxiliaryAnalysisProviderDeclarations(environment);
+    const nativeInspectionAvailable = inspection !== undefined &&
+        auxiliaryDeclarations.some(({ capabilities }) => capabilities.some(({ operation, available }) => operation === inspection && available));
+    return composeBinarySession(new AnalysisProviderRegistry([hopper, ghidra, ida, kuna], config.analysisProvider, nativeInspectionAvailable ? isAppleDispatchMetadataTarget : undefined), auxiliaryDeclarations.map((declaration) => new LazyAnalysisProvider(declaration)));
 };
 /** Compose an execution-free managed session without native provider selection. */
 export const createManagedBinarySession = () => composeBinarySession(new AnalysisProviderRegistry([]), [
@@ -27,3 +36,7 @@ export const createManagedBinarySession = () => composeBinarySession(new Analysi
 export const createArtifactBinarySession = (selectedEnvironment, platform = process.platform) => import("../artifacts/ArtifactProvider.js").then(({ ArtifactProvider }) => composeBinarySession(new AnalysisProviderRegistry([]), [
     new ArtifactProvider(snapshotEnvironment(selectedEnvironment, platform), platform),
 ]));
+/** Compose native inspection utilities without candidates for deep analysis. */
+export const createNativeBinarySession = (selectedEnvironment, platform = process.platform) => import("../native/NativeMacOSProvider.js").then(({ NativeMacOSProvider }) => composeBinarySession(new AnalysisProviderRegistry([]), [
+    new NativeMacOSProvider(snapshotEnvironment(selectedEnvironment, platform), undefined, platform),
+]));

package/dist/composition/directAnalysis.js

@@ -13,6 +13,14 @@ export const createDirectAnalysis = (selectedEnvironment) => {
             const { createManagedBinarySession } = await import("./binary.js");
             return createManagedBinarySession();
         },
+        createNativeDispatchBinarySession: async (config, logger) => {
+            const { createNativeDispatchBinarySession } = await import("./binary.js");
+            return createNativeDispatchBinarySession(config, logger, environment);
+        },
+        createNativeBinarySession: async () => {
+            const { createNativeBinarySession } = await import("./binary.js");
+            return createNativeBinarySession(environment);
+        },
         createArtifactBinarySession: async () => {
             const { createArtifactBinarySession } = await import("./binary.js");
             return createArtifactBinarySession(environment);

package/dist/composition/javascriptAnalysisWorkerProcess.js

@@ -1,7 +1,7 @@
 import { moduleResolutionModeForJavaScriptReference } from "../domain/javascript/javascriptModuleResolutionMode.js";
 import { parseJavaScriptSource } from "../domain/javascript/javascriptSourceParser.js";
 import { analyzeParsedJavaScriptStaticSourceSteps } from "../domain/javascript/javascriptStaticAnalysis.js";
-import { analyzeParsedJavaScriptSemanticsSteps, classifyParsedJavaScriptOpenReceiversSteps, } from "../domain/javascript/javascriptSemanticAnalysis.js";
+import { analyzeParsedJavaScriptSemanticsSteps } from "../domain/javascript/javascriptSemanticAnalysis.js";
 import { failedJavaScriptStaticAnalysis } from "../domain/javascript/javascriptStaticAnalysisHelpers.js";
 import { projectJavaScriptModuleSemantics } from "../domain/javascript/javascriptModuleSemanticIr.js";
 import { javaScriptTransferByteBudget, measureJavaScriptModuleTransfer, } from "../javascript/analysis/JavaScriptAnalysisTransfer.js";
@@ -9,7 +9,7 @@ import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js"
 import { projectJavaScriptSemanticFileSteps } from "../application/javascript/JavaScriptSemanticGraphBuilder.js";
 import { completeJavaScriptAnalysisSteps } from "../application/javascript/JavaScriptAnalysisControl.js";
 import { serveJavaScriptAnalysisWorker, } from "../javascript/analysis/JavaScriptAnalysisWorkerServer.js";
-const analyze = async (file, nodeBudget, callbacks) => {
+const analyze = async (file, capacity, callbacks) => {
     if (!file.text.included)
         throw new TypeError("JavaScript worker requires decoded source text");
     await callbacks.phase("parse");
@@ -19,8 +19,7 @@ const analyze = async (file, nodeBudget, callbacks) => {
         return null;
     }
     await callbacks.phase("static");
-    const receivers = await completeJavaScriptAnalysisSteps(classifyParsedJavaScriptOpenReceiversSteps(parsed));
-    const facts = await completeJavaScriptAnalysisSteps(analyzeParsedJavaScriptStaticSourceSteps(file.text.value, parsed, receivers));
+    const facts = await completeJavaScriptAnalysisSteps(analyzeParsedJavaScriptStaticSourceSteps(file.text.value, parsed));
     const resultBudgetBytes = await callbacks.checkpoint(facts);
     if (facts.parse_status === "failed")
         return null;
@@ -37,7 +36,7 @@ const analyze = async (file, nodeBudget, callbacks) => {
             module_transfer_bytes: measured.bytes,
         });
     await callbacks.phase("projection");
-    const projection = await completeJavaScriptAnalysisSteps(projectJavaScriptSemanticFileSteps(file, ir, nodeBudget, facts.electron.call_paths));
+    const projection = await completeJavaScriptAnalysisSteps(projectJavaScriptSemanticFileSteps(file, ir, capacity, facts.electron.call_paths));
     return { module, projection };
 };
 try {

package/dist/composition/jeb.js

@@ -1,6 +1,7 @@
+import { parseJebMcpTimeoutMs } from "../config/environment.js";
 import { ConfigurationError } from "../domain/configurationErrors.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { err } from "../domain/result.js";
-import { parseJebMcpEndpoint } from "../jeb/JebMcpEndpoint.js";
 import { JebProvider } from "../jeb/JebProvider.js";
 /**
  * Construct one JEB provider bound to the caller-selected MCP endpoint. An
@@ -8,28 +9,38 @@ import { JebProvider } from "../jeb/JebProvider.js";
  * MCP tool is composed alongside it.
  */
 export const createJebAnalysisProvider = (environment = process.env, connectionFactory) => {
-    const endpoint = parseJebMcpEndpoint(environment.REA_JEB_MCP_URL);
-    if (!endpoint.ok) {
-        const constraint = typeof endpoint.error.cause === "string"
-            ? endpoint.error.cause
-            : endpoint.error.message;
+    const requestTimeout = parseJebMcpTimeoutMs(environment.REA_JEB_MCP_TIMEOUT_MS);
+    if (!requestTimeout.ok)
+        return unconfiguredJebProvider(requestTimeout.error);
+    try {
+        return new JebProvider({
+            environment,
+            ...(requestTimeout.value === undefined
+                ? {}
+                : { requestTimeoutMs: requestTimeout.value }),
+            ...(connectionFactory === undefined ? {} : { connectionFactory }),
+        });
+    }
+    catch (cause) {
+        if (!(cause instanceof AnalysisInputError))
+            throw cause;
+        const constraint = typeof cause.cause === "string" ? cause.cause : cause.message;
         return unconfiguredJebProvider(new ConfigurationError("Invalid REA environment configuration", {
-            cause: endpoint.error,
+            cause,
             settings: [{ setting: "REA_JEB_MCP_URL", constraint }],
         }));
     }
-    return new JebProvider({
-        environment,
-        ...(connectionFactory === undefined ? {} : { connectionFactory }),
-    });
 };
-const unconfiguredJebProvider = (error) => ({
-    inspectAvailability: () => Promise.resolve({
-        status: "unavailable",
-        code: "not_configured",
-        reason: `REA_JEB_MCP_URL is invalid: ${error.settings[0]?.constraint ?? error.message}`,
-        diagnostics: { setting: "REA_JEB_MCP_URL" },
-    }),
-    close: () => Promise.resolve(),
-    execute: () => Promise.resolve(err(error)),
-});
+const unconfiguredJebProvider = (error) => {
+    const setting = error.settings[0]?.setting ?? "REA_JEB_MCP_URL";
+    return {
+        inspectAvailability: () => Promise.resolve({
+            status: "unavailable",
+            code: "not_configured",
+            reason: `${setting} is invalid: ${error.settings[0]?.constraint ?? error.message}`,
+            diagnostics: { setting },
+        }),
+        close: () => Promise.resolve(),
+        execute: () => Promise.resolve(err(error)),
+    };
+};

package/dist/config/environment.js

@@ -20,6 +20,7 @@ const environmentSchema = z.object({
         .min(1)
         .refine(isAbsolute, "REA_IDA_MCP_CONFIG must be absolute")
         .optional(),
+    REA_JEB_MCP_TIMEOUT_MS: providerStartupTimeoutSchema.optional(),
     GHIDRA_INSTALL_DIR: z
         .string()
         .min(1)
@@ -60,8 +61,41 @@ const environmentSchema = z.object({
         .default("info"),
     REA_REFERENCE_SECRET_PATTERNS_JSON: z.string().default("[]"),
 });
+/** Parse the JEB-only timeout at its isolated provider-composition boundary. */
+export const parseJebMcpTimeoutMs = (value) => {
+    if (value === undefined)
+        return ok(undefined);
+    const parsed = providerStartupTimeoutSchema.safeParse(value);
+    if (parsed.success)
+        return ok(parsed.data);
+    return err(new ConfigurationError("Invalid REA environment configuration", {
+        cause: parsed.error,
+        settings: [
+            {
+                setting: "REA_JEB_MCP_TIMEOUT_MS",
+                constraint: parsed.error.issues[0]?.message ?? "must be a valid timeout",
+            },
+        ],
+    }));
+};
 /** Parse individual settings before layered registration fragments are merged. */
-export const parseEnvironmentValues = (environment) => {
+export const parseEnvironmentValues = (environment, unresolvedSettings = new Set()) => {
+    // Unknown client-specific entries are preserved by registration owners and
+    // still cross the child-process boundary. Check their byte admission before
+    // the known-setting schema strips them; never include rejected values.
+    // Cordis expression values stay unknown, but their literal names are known.
+    const keys = new Set([...Object.keys(environment), ...unresolvedSettings]);
+    const invalidEntries = [...keys]
+        .filter((key) => key.includes("\0") ||
+        (Object.hasOwn(environment, key) && environment[key]?.includes("\0")))
+        .map((setting) => ({
+        setting,
+        constraint: "Environment variable names and values must not contain NUL bytes",
+    }));
+    if (invalidEntries.length > 0)
+        return err(new ConfigurationError("Invalid REA environment configuration", {
+            settings: invalidEntries,
+        }));
     const parsed = environmentSchema.safeParse(environment);
     if (!parsed.success) {
         // Zod messages name the constraint, never the rejected value.
@@ -91,7 +125,7 @@ export const parseEnvironmentValues = (environment) => {
 export const parseEnvironment = (environment, 
 // Registration expressions are not evaluated; their absence is not proven.
 unresolvedSettings = new Set()) => {
-    const parsed = parseEnvironmentValues(environment);
+    const parsed = parseEnvironmentValues(environment, unresolvedSettings);
     if (!parsed.ok)
         return parsed;
     const env = parsed.value;

package/dist/config/mcpInputSchemaProfile.js

@@ -12,7 +12,7 @@ export const mcpInputSchemaProfileSchema = z.enum(["full", "compact"]);
 export const compactPresentationForMcpInputSchemaProfile = (profile) => profile === "compact"
     ? { budgetBytes: COMPACT_INPUT_SCHEMA_BUDGET_BYTES }
     : undefined;
-const profileConstraint = 'REA_MCP_INPUT_SCHEMA_PROFILE must be "full" (default) or "compact". The compact profile advertises input schemas without nested annotation prose for providers that cap each tool schema\'s serialized size.';
+const profileConstraint = 'REA_MCP_INPUT_SCHEMA_PROFILE must be "full" (default) or "compact". The compact profile advertises bounded input schemas with fewer nested annotations for providers with schema compatibility constraints.';
 /** Parse the advertised input schema presentation selection. */
 export const parseMcpInputSchemaProfile = (value) => {
     if (value === undefined)

package/dist/config/parseConfig.js

@@ -1,4 +1,4 @@
-import { accessSync, constants } from "node:fs";
+import { accessSync, constants, statSync } from "node:fs";
 import { ok } from "../domain/result.js";
 import { parseEnvironment } from "./environment.js";
 import { homeDirectoryFromEnvironment } from "./homeDirectory.js";
@@ -7,7 +7,7 @@ import { MAC_HOPPER_SYSTEM_LAUNCHER, macHopperLauncherCandidates, } from "../app
 const executableAvailable = (path) => {
     try {
         accessSync(path, constants.X_OK);
-        return true;
+        return statSync(path).isFile();
     }
     catch {
         return false;
@@ -27,7 +27,11 @@ export const defaultHopperLauncherPath = (platform, homeDirectory, executable =
 };
 /** Parse provider configuration and runtime prerequisites at the composition root. */
 export const parseConfig = (environment) => {
-    const parsed = parseEnvironment(environment);
+    // JEB validates its own timeout during optional provider composition. It is
+    // not an AppConfig setting and must not prevent unrelated CLI/MCP startup.
+    // Registration validation still checks the complete environment directly.
+    const { REA_JEB_MCP_TIMEOUT_MS: _jebTimeout, ...appEnvironment } = environment;
+    const parsed = parseEnvironment(appEnvironment);
     if (!parsed.ok)
         return parsed;
     const env = parsed.value;

package/dist/contracts/adb/adbToolContracts.js

@@ -203,7 +203,7 @@ export const ADB_TOOL_CONTRACTS = [
     {
         name: "inspect_adb_window",
         ...toolContractMetadata("inspect_adb_window"),
-        description: "Report the window manager's current focus declarations (mCurrentFocus and mFocusedApp from `dumpsys window windows`, or from `dumpsys window displays` when the windows section declares neither, as on Android 16) — what is on screen at read time without any interaction. Read-only.",
+        description: "Report the window manager's focus declarations with display context, original lines and explicit summary status. Reads `dumpsys window windows`, falling back to `displays` only when no focus field is declared. Singular fields are unknown for multiple contexts or repeated declarations; inspect focus_contexts for every observation. Read-only; no interaction occurs.",
         kind: "adb-provider",
         inputSchema: adbInputSchemas.inspect_adb_window,
         outputSchema: evidenceResultOf(adbResultSchemas.inspect_adb_window),
@@ -285,7 +285,7 @@ export const ADB_TOOL_CONTRACTS = [
     {
         name: "uninstall_adb_package",
         ...toolContractMetadata("uninstall_adb_package"),
-        description: "Uninstall one package from the device (`adb uninstall`), removing its data for user 0. A device-mutating tool; absent packages report the device's own refusal reason.",
+        description: "Request package removal for user 0 (`adb shell pm uninstall --user 0`) without data retention. A device-mutating tool; absent packages report the device's own refusal reason.",
         kind: "adb-provider",
         inputSchema: adbInputSchemas.uninstall_adb_package,
         outputSchema: evidenceResultOf(adbResultSchemas.uninstall_adb_package),

package/dist/contracts/analysisViewApiSurfaceExample.js

@@ -3,7 +3,7 @@ export const API_SURFACE_EXAMPLE = {
     input: {
         source: {
             kind: "retained-evidence",
-            evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+            evidence_id: "ev_90073e9478eada1e2cc351b523e6ba9231c9b4bc9708773567b880094db9d4c7",
         },
         view: {
             kind: "api-surface",
@@ -12,10 +12,10 @@ export const API_SURFACE_EXAMPLE = {
         },
     },
     output: {
-        parent_evidence_id: "ev_9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
+        parent_evidence_id: "ev_90073e9478eada1e2cc351b523e6ba9231c9b4bc9708773567b880094db9d4c7",
         parent_operation: "inspect_web_network_capture",
-        parent_digest: "9e218c18bc6159ec9c8492a9130c286496fb1b6d9f03ec2f4ea3321ce2b15097",
-        view_digest: "47c1859b7a86dd10770061767300bdb6ec177a9254e8dc7863d5ea8603343da6",
+        parent_digest: "90073e9478eada1e2cc351b523e6ba9231c9b4bc9708773567b880094db9d4c7",
+        view_digest: "c9494341920dc4cff6ecc6d8ed2c5e3abf15976642c253248e220d45f290ca7b",
         artifact: {
             path: "/fixtures/api-surface.har",
             sha256: "bf58e2c06e55bfe7e0628157c4ad027ce0aeb81a10e8edef8a7f95b8e5f14225",